Harden runners

Either Harden-runner or Cimon from Cycode

Beware of these:

https://loresuso.github.io/blog/harden-runner-cve/
https://www.sysdig.com/blog/security-mechanism-bypass-in-harden-runner-github-action
https://boostsecurityio.github.io/lotp/